GitHub Advisoryadvisory · Packagist

GHSA-rj4f-cp4v-hvcv Magento Blind SQL Injection in the Search module

CRITICAL Published 2022-05-24 Modified 2024-01-10 Official page ↗
Aliases
CVE-2021-21024
Ecosystem
Packagist
Packages
magento/community-edition
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-89
Reviewed
2024-01-10

Affected packages

• Packagist magento/community-edition: < 2.3.6-p1 → fixed in 2.3.6-p1 • Packagist magento/community-edition: >= 2.4.0, < 2.4.1-p1 → fixed in 2.4.1-p1

Description

Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by a blind SQL injection vulnerability in the Search module. Successful exploitation could lead to unauthorized access to restricted resources by an unauthenticated attacker. Access to the admin console is required for successful exploitation.

Related

Alias · CVE (1)

  • CVE-2021-21024 Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by a blind SQL injection vulnerability in… vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References